1. Field of the Invention
The present invention relates to a vehicle controlling apparatus, in an on-vehicle electronic apparatus with a built-in microprocessor used for a vehicle-engine controlling apparatus for instance, which is improved for restarting a microprocessor with secured safety when the microprocessor is out of control, and in particular to a vehicle controlling apparatus having a function of monitoring runaway of a microprocessor.
2. Description of the Prior Art
There are various known technologies as follows related to runaway monitoring and restart control of a microprocessor.
For instance, Japanese Patent Laid-Open No. 7-196003 describes an AND circuit provided on a driving circuit of a vehicle safety apparatus of which drive is controlled by a microcomputer so that a vehicle safety apparatus such as an air bag is driven by a logical product of output of a discrimination circuit generating an operation permission signal when a watchdog pulse of the microcomputer is normal and an operation instruction signal of the microcomputer.
In this case, there is a problem that, if the microcomputer is restarted by a reset pulse, a vehicle driver cannot recognize occurrence of a temporary runaway of the microcomputer.
In addition, Japanese Patent Laid-Open No. 5-81222 describes a system comprised of two CPUs, namely a main CPU and a sub CPU wherein, in the case of a runaway or a failure of the main CPU, both CPUs are initialized or restarted by a reset signal outputted from a watchdog timer circuit provided outside, and in the case of a runaway or a failure of the sub CPU, the main CPU monitors it and outputs a reset signal to the sub CPU to initialize or restart it.
In this case, there is also a problem that, if the microcomputer is restarted by a reset pulse, the vehicle driver cannot recognize a temporary runaway of the microcomputer.
Besides, as a public domain technology related to the present invention, Japanese Patent Laid-Open No. 5-18315 describes an actuator of which drive is controlled by a microprocessor built into an engine controlling apparatus is initialized by feeding the engine controlling apparatus via a power relay driven by a power switch, and the above power relay operation is continued even after shutting off the power switch to cut off the power relay by finishing the initialization.
In this case, it is also configured so that, if the microcomputer is restarted by a reset pulse, the vehicle driver cannot recognize a temporary runaway of the microcomputer.
On the other hand, Japanese Patent Laid-Open No. 8-339308 describes a configuration wherein a microcomputer is completely stopped by detecting a malfunction of the microcomputer by a watchdog timer, and to recover it, supply of operating power of the microcomputer must be stopped once and then it must be supplied again.
In this case, its characteristic is that the microcomputer is not restarted unless the power switch is opened and closed, so the vehicle driver can recognize that the microcomputer had a malfunction.
Incidentally, as for these conventional apparatuses, malfunctions of an electronic apparatus can be broadly divided into a hardware failure of the microprocessor and peripheral circuits or temporary runaway trouble due to a noise malfunction of the microprocessor and so on, and the driver can recognize the hardware failures due to continuation of the phenomenon.
However, while the driver does not need to recognize a temporary runaway trouble due to a noise malfunction of the microprocessor and so on if it can be reset for automatic recovery, it is desirable, in the case where such a malfunction repeatedly occurs, to recognize it so as to take some follow-up measures.
In the case of the aforementioned Japanese Patent Laid-Open No. 8-339308 capable of recognizing this, the microprocessor is completely stopped once a runaway starts regardless of whether it is temporary or not.
However, completely stopping the vehicle is not necessarily the best for safety of the vehicle, and there are quite a few loads wherein, if the runaway is temporary, it is more desirable to immediately restart it if possible.
The present invention is implemented in order to solve the above problem and, its object is to provide a simple vehicle controlling apparatus capable of, in the case of a runaway of the microprocessor, immediately attempting to reset and restart it and. also forcing only the operation of loads to which a malfunction is detrimental to stop and releasing the forced stop by shutting off or reclosing of the power switch.
Another object of the present invention is to provide a simple vehicle controlling apparatus capable of, even in the case of forcedly stopped loads, releasing the forced stop while the power switch is shut off and the engine is stopped so as to allow the actuator""s operation for returning to its initial position.
A vehicle controlling apparatus related to the invention of claim 1 has a manually-operated power switch for on-vehicle engine operation, a first controlling means fed from an on-vehicle battery when the power switch is closed for controlling a plurality of on-vehicle loads, a monitoring means for monitoring the first controlling means and generating a reset pulse to restart the above first controlling means on a malfunction, storage means for storing generation of a reset pulse from the monitoring means, and an output stopping means for stopping operation of a load relay provided on a feeder circuit to the above on-vehicle load in response to operation of the storage means, and the above storage means is reset on opening or reclosing of the above power switch.
For instance, it is possible, in the case where a controlling means such as a microprocessor malfunctions or runs away due to noise, to stop operation of part of on-vehicle loads and release this stopping state until opening or reclosing of the power switch even if the microprocessor is restarted by reset pulse output, so that the on-vehicle loads involved in ordinary driving, for instance, will return to normal operation but output will be continuously stopped as to convenience improving devices related to reliability so as not to release this stopping state unless there is a purposeful operation of opening and closing the power switch, allowing the convenience improving devices to be adopted in a reassuring manner to contribute to improved reliability of the apparatus.
The vehicle controlling apparatus related to the invention of claim 2 has, in the invention of claim 1, a power relay for feeding the above first controlling means from the above on-vehicle battery on closing of the above manually-operated power switch, a delay outputting means for continuing operation of the above power relay after opening of the above power switch until part of the above on-vehicle loads returns to an initial position based on output of the above first controlling means, and a resetting means for resetting the above storage means on opening of the above power switch.
Even in the case where output is continuously stopped to on-vehicle loads such as an actuator requiring return to initial position on opening of the power switch due to noise malfunction or a runaway of controlling means such as a microprocessor for instance, it allows the return to the initial position since the power switch is opened and the vehicle has stopped and it thus produces an effect of enabling preparatory operations for the next driving to be made without losing reliability.
The vehicle controlling apparatus related to the invention of claim 3 has, in the invention of claim 1, a second controlling means for controlling on-vehicle loads other than the above plurality of on-vehicle loads, and monitoring of the above second controlling means and a restarting reset thereof on a malfunction are performed by the above first controlling means.
It has an effect of, if any microprocessor as controlling means malfunctions or runs away, immediately restarting it by reset pulse output and storing this state to continuously stop output of part of on-vehicle loads.
The vehicle controlling apparatus related to the invention of claim 4 has the above storage means operate in the invention of claim 3 based on logical sum output of a reset pulse from the above monitoring means and a reset pulse to the above second controlling means.
It has an effect of efficiently restarting the microprocessor on a malfunction or a runaway and storing this state to continuously stop output of part of on-vehicle loads.
The vehicle controlling apparatus related to the invention of claim 5, in the invention of claim 3, has the above storage means count the number of times of output of a reset pulse to the above first or second controlling means and operate the above output stopping means in response to generation of a reset pulse exceeding a predetermined number of times to stop operation of the above load relay.
It has an effect of, if the microprocessor or the sub-microprocessor as the first or second controlling means malfunctions or runs away as a very rare case, not continuously stopping output, but continuously stopping output in the case of repeated malfunctions or runaways and thus not wastefully losing the controlling function.
The vehicle controlling apparatus related to the invention of claim 6 has, in the invention of claim 3, a malfunction warning means for, in response to the operation of the above storage means, instructing to outside that the above first or second controlling means are malfunctioning and restarted by a reset operation.
It has an effect of, if there are on-vehicle loads of which output is continuously stopped due to a malfunction or a runaway of the first or second controlling means, aggressively warning outside of it in the case where a driver outside, for instance, cannot recognize it.
The vehicle controlling apparatus related to the invention of claim 7 uses, in the invention of claim 1, a watchdog timer as the above monitoring means.
It has an effect of, in the case where the microprocessor or the like malfunctions or runs away, securely monitoring and coping with it to contribute to improved reliability of the apparatus.